CVSS: 6.5EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1278 – chromium-browser: URL spoofing using pdf files in unspecified
https://notcve.org/view.php?id=CVE-2015-1278
23 Jul 2015 — content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document. Vulnerabilidad en content/browser/web_contents/web_contents_impl.cc en Google Chrome en versiones anteriores a la 44.0.2403.89, no asegura que el diálogo modal de un documento PDF esté cerrado en la navega... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1279 – chromium-browser: Heap-buffer-overflow in pdfium.
https://notcve.org/view.php?id=CVE-2015-1279
23 Jul 2015 — Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values. Desbordamiento de enteros en la función CJBig2_Image::expand en fxcodec/jbig2/JBig2_Image.cpp en PDFium implementado en Google Chrome en versiones anteriores a la 44.0.2403.89. Permite a atacantes remotos cau... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2015-1280 – chromium-browser: Memory corruption in skia
https://notcve.org/view.php?id=CVE-2015-1280
23 Jul 2015 — SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data. Vulnerabilidad en SkPictureShader.cpp de Skia usado en Google Chrome en versiones anteriores a la 44.0.2403.89. Permite a atacantes remotos causar una denegación de servicio mediante la corrupción de memoria o posiblemente tener otro impact... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1281 – chromium-browser: CSP bypass in unspecified component
https://notcve.org/view.php?id=CVE-2015-1281
23 Jul 2015 — core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source. Vulnerabilidad en core/loader/ImageLoader.cpp en Blink implementado en Google Chrome en versiones anteriores a la 44.0.2403.89, no determina adecuadamente el contexto V8 de una micro tarea, lo cual permite a atacantes remotos eludir la r... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2015-1282 – chromium-browser: Use-after-free in pdfium.
https://notcve.org/view.php?id=CVE-2015-1282
23 Jul 2015 — Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions. Múltiples vulnerabilidades de uso después de liberación de memoria en fpdfsdk/src/javascript/Document.cpp en PDFium implementada en Google Chrome en versiones anteriores a la 44... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0CVE-2015-1284 – chromium-browser: Use-after-free in blink.
https://notcve.org/view.php?id=CVE-2015-1284
23 Jul 2015 — The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements. Vulnerabilidad en la función LocalFrame::isURLAllowed en core/frame/LocalFrame.cpp en Blink impleme... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2015-1243 – chromium-browser: use-after-free in DOM
https://notcve.org/view.php?id=CVE-2015-1243
01 May 2015 — Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered. Vulnerabilidad de uso después de liberación en la función MutationObserver::disconnect en core/dom/MutationObserver.cpp en la im... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2015-1250 – chromium-browser: various unspecified flaws
https://notcve.org/view.php?id=CVE-2015-1250
01 May 2015 — Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 42.0.2311.135 permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. A use-after-free was discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafte... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html •
CVSS: 10.0EPSS: 10%CPEs: 31EXPL: 0CVE-2015-3038 – flash-plugin: multiple code execution issues fixed in APSB15-06
https://notcve.org/view.php?id=CVE-2015-3038
13 Apr 2015 — Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. Adobe Flash Player anterior a 13.0.0.281 y 14.x hasta 17.x anterior a 17.0.0.169... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html •
CVSS: 10.0EPSS: 8%CPEs: 31EXPL: 0CVE-2015-3039 – Adobe Flash Player AS2 ConvolutionFilter Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-3039
13 Apr 2015 — Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-0358. Vulnerabilidad de uso después de liberación en Adobe Flash Player anterior a 13.0.0.281 y 14.x hasta 17.x anterior a 17.0.0.169 en Windows y OS X y anterior a 11.2.202.457 en Linux permite a atacantes e... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html •